Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
6126 articles · 249396 vulns · 37/41 feeds (7d)
← Back to list
9.8
CVE-2026-65637PATCHED
apache · tomcat

Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

Description

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Affected Products

VendorProductVersions
apachetomcat11.0.20, 10.1.53, 9.0.115

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
apachetomcatcert_advisory90%
atlassiancruciblecert_advisory90%
atlassianbitbucketcert_advisory90%
atlassianfisheyecert_advisory90%
atlassianbamboocert_advisory90%

References

  • https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj(vendor-advisory)

Related News (8 articles)

Tier B
BSI Advisories2d ago
[NEU] [hoch] Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen
→ No new info (linked only)
Tier B
CERT-FR7d ago
Multiples vulnérabilités dans les produits IBM (16 octobre 2026)
→ No new info (linked only)
Tier B
CERT-FR21d ago
Multiples vulnérabilités dans les produits VMware (02 octobre 2026)
→ No new info (linked only)
Tier B
CERT-FR42d ago
Multiples vulnérabilités dans les produits IBM (11 septembre 2026)
→ No new info (linked only)
Tier B
BSI Advisories58d ago
[NEU] [hoch] Apache Tomcat: Mehrere Schwachstellen
→ No new info (linked only)
Tier C
oss-security58d ago
CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
→ No new info (linked only)
Tier B
CERT-FR58d ago
Multiples vulnérabilités dans Apache Tomcat (26 août 2026)
→ No new info (linked only)
Tier C
VulDB58d ago
CVE-2026-65637 | Apache Tomcat up to 11.0.24/10.1.57/9.0.120 input validation
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.19.8 CRITICAL
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA KEV❌ No
Actively exploited❌ No
Patch available
https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj
CWECWE-20
PublishedAug 25, 2026
Trending Score50
Source articles8
Independent4
Info Completeness0/14
Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-65905
Apache Tomcat: Limited replay attack possible with DIGEST authentication
Trending: 68
CRITICALCVE-2026-68525
Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
Trending: 51
CRITICALCVE-2026-65182
Apache Tomcat: Bypass longest prefix security constraint
Trending: 50
CRITICALCVE-2026-84939
Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks
Trending: 49
CRITICALCVE-2026-103119
Apache Tomcat: AJP response mix-up
Trending: 44

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Aug 25, 2026
Discovered by ZDM
Aug 25, 2026
Patch Available
Aug 26, 2026